T09 · Insecure Skill Coding Practices
- Location
scripts/tga.js:76- Finding
Authentication Token Cached Without Restrictive File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/tga.js, lines 76–79
Vulnerability Type: Plaintext sensitive credential stored with process-default permissions
Risk Level: MediumVulnerable Code
javascript function saveToken(token) { fs.writeFileSync(TOKEN_PATH, JSON.stringify({ token }, null, 0), 'utf8'); console.log('Token 已写入:', TOKEN_PATH); }Technical Analysis
The Skill stores the TGA bearer token in
.tga-tokenas plaintext without explicitly setting restrictive file permissions.fs.writeFileSynctherefore relies on the process umask when creating the file and preserves the permissions of an existing file when overwriting it.On systems with a permissive umask, an insecure preexisting
.tga-token, shared accounts, or broadly accessible Skill directories, another local user or process may be able to read the token. Because the token is subsequently accepted as an authorization credential by TGA APIs, possession may allow API access without knowing the login name, encrypted password, or browser cookies.This token cache supports the documented workflow, but leaving its access controls to the execution environment exceeds the minimum safe privilege exposure necessary for caching.
Attack Path
- The legitimate user runs
node scripts/tga.js login. - The script obtains a valid TGA access token and writes it to
.tga-token. - The resulting file is readable by another local user or compromised process because of a permissive umask, directory permissions, or preexisting file mode.
- The attacker reads and parses the plaintext token.
- The attacker submits the token to the TGA APIs before it expires or is revoked.
- API operations execute with the permissions associated with the victim's TGA session.
Impact Assessment
Successful exploitation may expose TGA projects and downloadable reports available to the authenticated account. The attacker could potentially ...[truncated 397 chars]
- The legitimate user runs
- Remediation
View remediation
Remediation Suggestions
-
Create the token file with owner-only permissions:
javascript fs.writeFileSync( TOKEN_PATH, JSON.stringify({ token }), { encoding: 'utf8', mode: 0o600 } ); -
Because the creation mode does not repair an insecure existing file, explicitly enforce permissions after writing:
javascript fs.chmodSync(TOKEN_PATH, 0o600); -
Use an atomic replacement strategy with a temporary file created as
0o600, then rename it into place. Ensure the temporary file is created in a private directory. -
Verify that the Skill directory is not writable or readable by unrelated local users.
-
Prefer an operating-system credential store or secret-management service instead of a plaintext JSON file.
-
Delete the cached token when it is invalidated and support explicit logout or token revocation.
-
Avoid printing token values or file contents in logs.
-